Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2024-44965

x86/mm: Fix pti_clone_pgtable() alignment assumption

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 4.19.320, 5.4.282, 5.10.224, 5.15.165, 6.1.105, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix pti_clone_pgtable() alignment assumption Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then #DF from the stack guard. It turned out that pti_clone_pgtable() had alignment assumptions on the start address, notably it hard assumes start is PMD aligned. This is true on x86_64, but very much not true on i386. These assumptions can cause the end condition to malfunction, leading to a 'short' clone. Guess what happens when the user mapping has a short copy of the entry text? Use the correct increment form for addr to avoid alignment assumptions.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From 16a3fe634f6a568c6234b8747e5d50487fed3526 · fixed in 18da1b27ce16a14a9b636af9232acb4fb24f4c9e; From 16a3fe634f6a568c6234b8747e5d50487fed3526 · fixed in 25a727233a40a9b33370eec9f0cad67d8fd312f8; From 16a3fe634f6a568c6234b8747e5d50487fed3526 · fixed in d00c9b4bbc442d99e1dafbdfdab848bc1ead73f6; From 16a3fe634f6a568c6234b8747e5d50487fed3526 · fixed in 4d143ae782009b43b4f366402e5c37f59d4e4346; From 16a3fe634f6a568c6234b8747e5d50487fed3526 · fixed in 5c580c1050bcbc15c3e78090859d798dcf8c9763; From 16a3fe634f6a568c6234b8747e5d50487fed3526 · fixed in ca07aab70dd3b5e7fddb62d7a6ecd7a7d6d0b2ed; From 16a3fe634f6a568c6234b8747e5d50487fed3526 · fixed in df3eecb5496f87263d171b254ca6e2758ab3c35c; From 16a3fe634f6a568c6234b8747e5d50487fed3526 · fixed in 41e71dbb0e0a0fe214545fe64af031303a08524c

  • Linux Linux

    4.19

  • KernelLinux

    From 4.19.0 · fixed in 4.19.320; From 4.20.0 · fixed in 5.4.282; From 5.5.0 · fixed in 5.10.224; From 5.11.0 · fixed in 5.15.165; From 5.16.0 · fixed in 6.1.105; From 6.2.0 · fixed in 6.6.46; From 6.7.0 · fixed in 6.10.5

References 8

git.kernel.org